Duplicate syslog events were reported in JSA, with the same event appearing multiple times on different hosts and, in some cases, up to 90 times.

Below things are observed in the JSA log activity tab.

1. Duplicate syslog events are observed in JSA.
2. The same event may appear multiple times.
3. A single event was observed up to 90 times.
4. Duplicate syslog messages were confirmed using tcpdump.

The investigation confirmed that JSA is not generating the duplicate syslog events.

1. A tcpdump capture confirmed that duplicate syslog messages are received on the network before reaching JSA.
2. JSA is therefore processing the messages it receives as expected.
3. The Event Collector is licensed for approximately 16,000 EPS, while the observed incoming rate exceeded 20,000 EPS.
4. Existing routing rules are configured to discard selected events and reduce the overall event rate.
5. Windows events were reviewed using the unique Event Record Number to identify potential duplicates. One duplicate Windows event was observed.
6. The WinCollect agent is not running the latest version. Upgrade WinCollect and monitor the issue.
7. Verify the original log sources and compare the events generated on the source with the events received by JSA.

Since duplicate syslog messages are confirmed in tcpdump before JSA processes them, JSA is functioning as expected.

Further investigation is required on the source systems and network infrastructure to determine why duplicate syslog messages are being generated or transmitted.